Hono’s static site generation function toSSG() incorrectly normalizes paths that contain consecutive parent-directory segments, allowing attacker-controlled route parameters to create file paths that resolve outside the configured output directory. An exploit permits the attacker to create or overwrite arbitrary files in the build environment, which can corrupt deployment outputs or inject malicious code into the generated site. The flaw does not affect request-time routing or fully developer-controlled parameters, but it can be leveraged during build time when the application consumes untrusted slugs from a CMS, API, or user submission.

Hono framework versions from 4.12.12 through 4.13.4 are vulnerable. The issue is addressed in version 4.13.5 and later, so any deployment using these earlier releases is at risk.

The CVSS score of 6.5 indicates a moderate severity vulnerability with potential integrity impact. No EPSS score is available, and it is not listed in CISA’s KEV catalog, suggesting limited known exploitation activity. The most likely attack vector is build-time static site generation by a deployment pipeline that incorporates untrusted user data into route parameters. While the vulnerability cannot be triggered through normal request handling, an attacker who can influence the build process can exploit it to tamper with site artifacts.